Re: Setting a request header to value from POST data

Hey Andres,

On Fri, Aug 23, 2019 at 09:05:29PM +0000, Andres Ofner wrote:
> Hi Christian,
> 
> I did some debuglogging, but quite soon detected what I now think was the
> culprit. We had comments mostly with ticket numbers for the
> SecRuleRemoveById statements in the config - but not in a separate line, but
> INLINE, meaning some lines like this one (ids randomized):
> "SecRuleRemoveById  123456     # PRJ-1234" or that one: "SecRuleRemoveById
> 123456      # Request Missing an Accept Header (bad merchant
> implementations)" and others...
> 
> I strongly suspect that these are not interpreted correctly as comments, but
> rather as part of the id list or range, and might be misinterpreted and
> therefore match the new SecRule (and probably some others as well). 

This. Apache does not swallow this.

Comments need to be on separate lines.

And a final hint about an Apache specialty:

The following rule with 1008 is commented out / not active. Many hours have
been spent debugging this behaviour.

# Bla bla ...
# SecRule ARGS:foo ".*" "id:1006,phase:2,pass,capture,setenv:foo=%{TX.0}" \
SecRule ARGS:foo ".*" "id:1008,phase:2,pass,setenv:foo=%{TX.0}"

Ahoj,

Christian


-- 
Given the choice between two theories, take the one which is funnier.
--- Blore's Razor, Author unknown


_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/